CVE-2026-108562 · Package
NO FIX YET · SEE WHAT TO DO
A manager in Revive Adserver can save a tracker name containing JavaScript, which then appears unescaped on the append-code maintenance results page. When an administrator opens that page, the script runs in the administrator's browser.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running Revive Adserver 6.0.8 or earlier where users with the manager role can create trackers. The attacker must be an authenticated manager, and the script runs when an administrator opens the maintenance page. Installations where only trusted administrators hold manager access carry lower risk.
Not affected if no-manager-accounts, version-6.0.9-or-later
Who cares php, revive-adserver, self-hosted
6.0.8 and earlier are affected.6.0.9 or later.A stored cross-site scripting vulnerability in maintenance-appendcode-check.php in Revive Adserver 6.0.8 and earlier allows an authenticated manager to execute JavaScript in an administrator's browser. A manager can store a malicious tracker name and cause the tracker to appear in the append-code maintenance results. When an administrator opens the affected maintenance page, the tracker name is included in HTML without appropriate encoding. The issue is fixed in Revive Adserver 6.0.9 by HTML-encoding tracker names when displaying the maintenance results.
This page as .md · .json · CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.